We take security seriously at ShoeSafari. If you discover a security vulnerability, please report it responsibly.

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Email security concerns to: [your-security-email@domain.com]
3. Include a detailed description of the vulnerability
4. Provide steps to reproduce if possible

• Acknowledgment within 48 hours
• Regular updates on our progress
• Credit in the security advisory (if desired)

All sensitive configuration is stored in environment variables. Never commit secrets to the repository.

Required environment variables are documented in .env.local.example. Copy this file to .env.local and fill in your values.

cp .env.local.example .env.local

The Soroban escrow contract follows security best practices:

1. Non-custodial: Funds flow directly from buyer to contract to merchant
2. Access Control: Only authorized parties can dispatch/refund orders
3. Token Whitelist: Only approved tokens can be used for payment
4. Event Emission: All state changes emit events for transparency
5. Error Handling: Typed errors prevent unexpected failures

1. Input Validation: All user inputs are validated and sanitized
2. XSS Prevention: HTML entities are escaped before rendering
3. HTTPS Only: All API calls use HTTPS
4. No Sensitive Data in URLs: Sensitive data is sent via POST body
5. Content Security Policy: Configured in Next.js headers

• Firebase Authentication handles user sessions
• Admin access is controlled via email whitelist (NEXT_PUBLIC_ADMIN_EMAILS)
• No passwords are stored in the application

• Dependencies are regularly updated for security patches
• Use npm audit to check for vulnerabilities
• CI pipeline fails on high-severity vulnerabilities

Before submitting a PR, ensure:

• No secrets or API keys are committed
• User inputs are validated and sanitized
• No eval() or dangerouslySetInnerHTML usage
• Error messages don't expose sensitive information
• Dependencies are from trusted sources
• No console.log with sensitive data

The current OTP implementation generates codes client-side for demonstration purposes. In production:

• Move OTP generation to a server-side API route
• Implement rate limiting on OTP requests
• Add OTP expiration (recommended: 5 minutes)

The card payment form fields are UI-only placeholders. In production:

• Integrate with a PCI-compliant payment processor (Stripe, etc.)
• Never handle raw card data on your servers
• Use tokenization for card storage

Ensure your Firestore security rules restrict:

• Read/write access based on authentication
• Admin operations to authorized users only
• Data validation at the database level

Example rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /ShoeSafariProducts/{productId} {
      allow read: if true;
      allow write: if request.auth != null &&
        request.auth.token.email in ['admin@example.com'];
    }
  }
}

• Testnet: Used for development, tokens have no real value
• Mainnet: Real value transactions, requires additional auditing

Before mainnet deployment:

1. Smart contract security audit
2. Penetration testing
3. Rate limiting implementation
4. Monitoring and alerting setup

• Users connect their own Freighter wallet
• Private keys never leave the user's browser
• Transactions require explicit user approval

For security-related inquiries:

• Email: [your-security-email@domain.com]
• Response time: Within 48 hours